Card as a Service · Card API

Virtual card issuing API

Issue a card in one call. Scoped keys, idempotency, signed webhooks and real-time authorization.

Request access Get API keys
  • REST + JSON
  • Signed webhooks
  • Keys right after sign-up
01 — How it works

Live in three steps.

  1. Minute 1Get keys

    Sign up in the console; keys come right away.

    api
    · key gp_live_7f3a… ✓
    · scopes: cards:issue
  2. Minute 2Issue a card

    One request with an idempotency key.

    api
    POST /cards 201
    PATCH /cards/4417/limits 200
  3. Day 1Listen to events

    Signed webhooks with retries.

    api
    ⇢ card.issued ✓
    ⇢ transaction.posted ✓
02 — What you get

Card API, end to end.

REST

One call — one card

Issue, label, limit, block, unblock and cancel cards; idempotency keys on issuing and funding.

GuaraVIRTUAL
•••• •••• •••• 0932
API · opsMASTERCARD
Keys

Scoped keys

Each key gets only the scopes you pick.

cards:issuewebhooks:manage
Keys

Zero-downtime rotation

Two live keys at once.

Webhooks

Signed, retried

HMAC-SHA256, 7 retries.

Authorization

Real-time decisions

Approve or decline in 1.2 s.

APPROVEDECLINE
03 — Code

A few lines
to start.

Same REST API, same keys and limits for every program. Docs open in the console after sign-up.

Request access →All API samples
const res = await fetch("https://api.guarapay.io/api/v1/partner/cards", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.GUARA_KEY}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    external_user_id: "user_42",
    product: "standard",
    label: "Wallet · user_42",
    cardholder: { first_name: "Ada", last_name: "Lovelace" },
  }),
});

const { data: card } = await res.json(); // same Idempotency-Key never issues twice
04 — Access

Tell us what you're building.

Three steps from here to live cards.

  1. We reply within a business dayPricing for your volume, by email or your contact.
  2. You connect the APIKeys, webhooks and MCP for your agents.
  3. You go liveSwitch to live keys and issue cards to your users.
Prefer email? support@guarapay.io
What will the cards be for?
Cards per month

We use these details only to reply to your request. See our Privacy Policy.

05 — Details

Card API: FAQ

How do I authenticate?

With a bearer API key. Each key has its own scopes, and two live keys let you rotate without downtime.

What if a request is retried?

Send an Idempotency-Key: the same key never issues a second card.

How are webhooks signed?

With X-GuaraPay-Signature, an HMAC-SHA256 over the timestamp and the raw body. Every webhook is retried up to 7 times.

Where are the docs?

In the console, right after sign-up, together with your API keys.

Virtual card issuing APIRequest access →